ING Direct 2013 Annual Report Download - page 312

Risk management continued ING Bank
Following the establishment of a Cybercrime Task Force in 2012, ING Bank has set up a Cybercrime Resilience Program in 2013 to
structurally address the cybercrime threats. Within the programme, ING Bank has defined a wide range of measures, on top of existing IT
security measures, to strengthen ING’s resilience against e-banking fraud, DDoS and targeted attacks (also called Advanced Persistent
Threats). To monitor and to respond to cybercrime effectively across ING Bank, a permanent central CyberCrime Emergency Response
Team has been established.
ING Bank is continuously working on strengthening its global cybercrime resilience including strengthened collaboration against
cybercrime with the financial industry, law enforcement authorities, government (e.g. National Cyber Security Center) and Internet Service
Providers (ISPs).
Advanced Measurement Approach (AMA)
ING Bank has an Operational Risk Capital model in place in which the risk profile is closely tailored to the internal profile of ING Bank and
its divisions by using scenario data for capturing severe risks and internal loss and Risk & Control Self-Assessment data for capturing
day-to-day risks. The business has a strong role in assessing scenario severities and the Operational Risk Management function in validating
the results. In 2013 workshops were held at the regional level and the scenario coverage has been expanded by introducing more relevant
scenario topics. The internal data based calculation is combined with an external loss data (ORX) based calculation. The better scenario
coverage is demonstrated for a unit of measure, the more weighting is given to scenarios in the calculation.
In April 2013 ING Bank obtained accreditation for use of its enhanced AMA model for regulatory supervision purposes. ING Bank is
reporting the regulatory capital numbers on a quarterly basis. The AMA capital for the fourth quarter of 2013 amounts to EUR 2,822
million. For the fourth quarter of 2012 the AMA capital amounted to EUR 2,836 million.
Compliance risk
Compliance risk is defined as the risk of impairment of ING Bank’s integrity as a result of failure (or perceived failure) to comply with
relevant laws, regulations, ING Bank policies and standards and the ING Bank Business Principles. In addition to reputational damage,
failure to effectively manage compliance risks could expose ING Bank to fines, civil and criminal penalties, and payment of damages, court
orders and suspension or revocation of licenses, which would adversely impact customers, staff, shareholders and other stakeholders of
ING Bank.
The compliance risk management function supports management in mitigating the compliance risks and by establishing a compliance
control framework derived from laws, regulations and standards. The compliance risk management function actively educates and
supports the business in managing compliance risks related, but not limited to, money laundering, terrorist financing, sanction and export
control compliance, conflicts of interest, mis-selling, bribery and protection of customer interests.
ING Bank categorises compliance risk into four conduct-related integrity risk areas: client conduct, personal conduct, organisational
conduct and financial conduct. ING Bank has a Whistleblower Policy which encourages staff to speak up if they know or suspect a breach
of external regulations, internal policies or Business Principles.
Financial Economic Crime (’FEC‘) policy
The ING Bank FEC Policy provides a clear statement of what is required by all ING Bank entities in order to guard against any involvement
in criminal activity, and to participate in international efforts to combat money laundering and the funding of terrorist and criminal
activities. The requirements in the ING Bank FEC Policy cover minimum standards and controls related to: money laundering, terrorist
financing, export trade controls, proliferation financing, sanctions (economic, financial and trade) and countries designated by ING Bank as
Ultra High Risk Countries (UHRC).
The ING Bank FEC Policy directly reflects relevant national and international laws, regulations and industry standards. The ING Bank FEC
Policy is mandatory and applies to all ING banking entities, majority owned ING business, businesses under management control, staff
departments, product lines and to all client engagements and transactions.
Management of ING Bank entities introduce appropriate local procedures that enable them to comply with local laws, regulations and the
relevant ING Bank FEC Policy. Where local laws and regulations are more stringent, the local laws and regulations are applied. Likewise the
FEC Policy prevails when the standards therein are stricter than local laws and regulations.
As a result of frequent evaluation of all businesses from economic, strategic and risk perspectives ING Bank continues to believe that for
business reasons doing business involving certain specified countries should be discontinued. In that respect, ING has a policy not to enter
into new relationships with clients from these countries and processes remain in place to discontinue existing relationships involving these
countries. At present these countries are Myanmar, North Korea, Sudan, South Sudan, Syria, Iran and Cuba. Each of these countries is
subject to a variety of EU, US and other sanctions regimes. Cuba, Iran, Sudan, and Syria are identified by the US as state sponsors of
terrorism and are subject to U.S. economic sanctions and export controls.
310 ING Group Annual Report 2013